Is CVE-2026-40193 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40193 being exploited in the wild.

How severe is CVE-2026-40193?

High severity, with a CVSS score of 8.2, published 16 April 2026.

Which products and versions are affected?

Foxcpp Maddy < 0.9.3; github.com/foxcpp/maddy (Go) < 0.9.3, SEMVER:introduced=0,fixed=0.9.3.

Is there a fix for CVE-2026-40193?

Yes. github.com/foxcpp/maddy (Go): upgrade to 0.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40193 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40193?

Check whether you run Foxcpp Maddy, github.com/foxcpp/maddy (Go) or Maddy Project Maddy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40193: foxcpp Maddy Mail Server LDAP filter injection in auth.ldap

Q: Which products and versions are affected?

Foxcpp Maddy < 0.9.3; github.com/foxcpp/maddy (Go) < 0.9.3, SEMVER:introduced=0,fixed=0.9.3.

Q: Is there a fix for CVE-2026-40193?

Yes. github.com/foxcpp/maddy (Go): upgrade to 0.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-40193 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-40193?

Check whether you run Foxcpp Maddy, github.com/foxcpp/maddy (Go) or Maddy Project Maddy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40193 · Severity: high · CVSS 8.2 · Published 2026-04-16

Maddy Mail Server is an all-in-one email server solution. A vulnerability in its LDAP authentication module allows attackers to manipulate database queries by providing specially crafted usernames during login. This can lead to unauthorized access, the ability to impersonate other users, and the theft of sensitive directory information such as account details and password hashes.

Technologies: github.com/foxcpp/maddy (Go). Vendors: Go.

Quick answers

Is CVE-2026-40193 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40193 being exploited in the wild.
How severe is CVE-2026-40193?: High severity, with a CVSS score of 8.2, published 16 April 2026.
Which products and versions are affected?: Foxcpp Maddy < 0.9.3; github.com/foxcpp/maddy (Go) < 0.9.3, SEMVER:introduced=0,fixed=0.9.3.
Is there a fix for CVE-2026-40193?: Yes. github.com/foxcpp/maddy (Go): upgrade to 0.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40193 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40193?: Check whether you run Foxcpp Maddy, github.com/foxcpp/maddy (Go) or Maddy Project Maddy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/foxcpp/maddy (Go): upgrade to 0.9.3 or later
```
go get github.com/foxcpp/maddy@v0.9.3
```

Technical details

The `auth.ldap` module in Maddy Mail Server performs direct string interpolation of user-supplied usernames into LDAP search filters and Distinguished Name (DN) strings using `strings.ReplaceAll()`. Because the input is not escaped using `ldap.EscapeFilter()`, an attacker can inject LDAP filter operators (e.g., `*`, `(`, `)`) via the SMTP (AUTH PLAIN) or IMAP (LOGIN) interfaces. This enables boolean-based blind injection and timing side-channel attacks to enumerate directory structure and extract attribute values (like password hashes). The vulnerability is present in `internal/auth/ldap/ldap.go` and is fixed in version 0.9.3.

Affected products

foxcpp maddy < 0.9.3

Identifiers

CVE-2026-40193
GHSA-5835-4gvc-32pc
GO-2026-5137

Timeline

2026-04-12: advisory: GitHub Advisory published
2026-04-13: disclosed
2026-04-16: other: Advisory updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.